I like to start off this article by quoting the chorus verse from the poem written in 1778:

“We two have paddled in the stream,
from morning sun till dine;
But seas between us broad have roared
since auld Lang syne.”

So how does this matter with the good ole days? Well for starters, let’s take a quick tour of the olden days and see how the “old long since” has changed.

From time immemorial, innovation, and advances in science and technology were linked with Europe and in the last century with the Americas. The industrial revolution in the early turn of the century and the migratory pattern ensured the United States of America became the leaders and the trail setters in every industry.

However with every bell curve cycle since the end of World War II, the innovation edge was slowly lost (and finally over the last decade). Countries that were once reliant on products and services were taking the driver’s seat in leading the charge to make the same products and offer the same services at a much lower costs.

With the turn of the century, the “O-word” was in! In the race to increase operational efficiency, organizations have steadily over the years gone from business process outsourcing, to knowledge process outsourcing.

Did I mention the “O-word” was the hottest thing today? Over the last five years there started another dimension of outsourcing – original design manufacturing (copying your original design and mass producing it at a fraction of the cost).

What I want to do today, in true Star Trek-style, is walk you through the maze of this new outsourcing model and take you “where no man has gone before.” I want to show you how to achieve basic business continuity while continuing operational efficiency.

Let me provide you with the version of the 10 basic rules that will help ensure you survive the good ole days and adjust to the new ones!

1.Supplier’s Pareto Rule

Remember, Pareto’s rule – identify the 20 percent that will cause you the 80 percent grief. Know which suppliers are your Achilles’ heel!

You will have this list of suppliers and key vendors that you use for your operational survival. And while your first reaction is to look at money spent as the biggest driver in identifying the highest risk, think again. Money spent is not the only criteria in identifying your top suppliers who can bring you down.

Tier your supplier based on money spent, single product manufactured, and even single source supplied to your organization (for pricing purposes). You will be shocked once you do your analysis to see there will be a few skeletons in your closet that will cause you sleepless nights.

In 2009, a little-known battery manufacturer that made battery cells and supplied to all the major laptop manufacturers in the world had a fire in the factory. This fire impacted every single manufacturer of laptops in the world in various levels for a significant period of time.

The auto industry in late 2008/early 2009 suffered a major backlog because a small manufacturer of the humble piston rings had a business interruption incident and no plan. This resulted in a world-wide delay of product launches for existing and new orders

2. Poll your Critical Suppliers

Once you have narrowed down your top 20 percent (or high risk suppliers/vendors), prepare a questionnaire you can send to poll your suppliers. This questionnaire needs to cover the basics systems assessment, BCRP assessment, and business redirection all in five questions.

Suggested questions are:

Do you have fire and safety systems in place?

Do you have a business continuity plan?

Can you redirect your business to meet your client contractual needs?

What is the timeline (hours from of disaster declaration) to start redirection and ramp up to 100 percent?

Have you tested your BCRP plan?

3. Do your Homework – Define and set Standards Requirements

Remember the saying “Rome wasn’t build in a day?” Standards in North America evolved over time, and in that same context, don’t assume that what is in place in the USA today, are the same standards that are being compared to, in another part of the world.

U.S. fire and safety codes have a lot more rigor around sprinkler system installations in highly combustible environments as compared to non-existent requirements for sprinkler systems in the same highly combustible environments in China.

Be prepared to have professionals to define what fire and safety systems you must have as minimum standards. If you have insurance for your building or site, it would have had to meet certain building, fire and safety code. These are the minimum standards you would want your vendor or supplier to adhere to.

4. Visit your Top Suppliers in each Tier

There are two reasons why you wanted to keep the questions No. 2 closed ended:

Given the language barrier and translation challenges, if you leave it ambiguous or open-ended there is room for misinterpretation.

I can almost guarantee you will get back a 100 percent positive response from each of your respondents.

Should this worry you? You bet!! Don’t let these reasons lull you into a false sense of security!

Resource and funding permitting, try and get to your supplier’s site (for each tier), especially if they are manufacturing or producing goods for you.

If you have the services of an engineering firm (your insurance company can be your ally in procuring these services for free or for a nominal fee) engage them to review your vendor/supplier’s construction and fire and safety systems onsite.
Pay special attention to the following:

You will be amazed to know how many sites are in geographically hazardous locations.
Shocking review will show that based on geographical conditions, construction is not up to specifications (i.e. roof may not be able to withstand high tornado or rains).

Fire systems review may uncover that they are not adequate or that the current coverage is only 5-10 percent while your business loss expectancy could be 500 or 1,000 times greater.

Review may uncover that the roof is made of highly-combustible material that will cause a full-blown fire, resulting in 100 percent destruction of the site.

Review may uncover that no fire evacuation drills have been conducted at the site.
Review of equipment on the floor may uncover the fact that they are unsafe to operate and the accident ratio is extremely high (which is not a concern to you, but a moral and ethical issue).

Business continuity “plans” may be nothing more than “glorified evacuation drill documents” which, in most cases, may have never been practiced or executed.

5. Business Continuity Strategies

The economic downturn in North America has forced global corporations to turn to look at other means to cut costs and look deeper into their souls. Where is the single biggest overhead in in North America? Labor costs!

Business process outsourcing and knowledge process outsourcing have been success stories over the last few years to achieve the ultimate goal – operational efficiency.

However, does operational efficiency provide for operational resiliency? As more global corporations cut costs to achieve efficiencies of scale, remember that your suppliers do too.

They have a strategy. Yes, they have multiple sites and tell you they can redirect. But here is the catch. You are not a dedicated client! Think of yourself as part of a telephone “family plan.” If the minutes in the family plan are exhausted, there are no more minutes, no matter what you do. Most suppliers run their operational capacity at 110 percent! Even though these economic times have resulted in some downtime for these suppliers, what you have to keep in mind is the following:

While they may have isolated the way products or services are being delivered to each customer, they cannot be cross functional.

In other words, “I cannot manufacture my product on your manufacturing line and vice versa.”

So while they may turn blue in the face trying to convince you otherwise, contractually they have already signed a memorandum of understanding. It may even be hard-written into the contract with your competitor.

So if you are in a pinch, I assure you, your competitor is not going to graciously offer you their services and their manufacturing capabilities to allow you to ramp up to 100 percent capability. Think again!!

6. Business Continuity Plan

They can give you a pretty document, but if they cannot execute tip No. 5 they really don’t have a plan do they? And in the plan, what you need to be looking for is proof of redirection and sustainability to support your capacity/ work that has been outsourced to them.

Almost with consistency you will get a nice fluffy document that has a lot of tabs, in a heavy binder, that has probably killed a few trees. However, nowhere in that document will you find any documentation that demonstrates or shows evidence of production redirection capability.

So, why is this important? Referring to tip No. 5, production capability cannot be shared at an existing site since it is a shared model. So, the only alternative is for the vendor/supplier to be able to produce somewhere else.

If that is not evidenced in the document, then there really is no plan.

7. Test with Them

If by a miracle, they do have a plan that has evidenced proof of redirection, then ask to be partners with them in the next testing cycle. You, as a partner, will need to be involved as your level of outsourcing increasing and your risk increases.

What are you testing for? Testing can be done in phases.

Phase 1- Table Top Test: Validate the top risk and work with them to identify their mitigation strategy and ensure they can fix it. Sometimes this may require a give-and-take and may affect your price-per-unit operationally. In the long run, it will make business sense.

Phase 2 – If the vendor/supplier is ready and geared towards a redirection, be an active participant in the test. This will help ensure not only your interest, but validate any glitches that may exist in the process in the event of a true failover. (This test will also help validate their true level of external dependencies and whether this is captured in their plan.)

8. Timeline

One common mistake that is not caught on is that even if you have a clause that says the vendor must have a BCRP plan, does it stipulate what is an acceptable recovery time within which the vendor must start being able to deliver products and/or services to you?

Most vendors/suppliers are single manufacturing units (see tip No. 1). This is how they maintain their operational efficiency. In the event of a business interruption, say in a scenario of a fire on their production floor where there is no sprinkler system, the whole place will be gutted and gone! In this case, the ramp time for you will not be hours but months, as the factory will have to be rebuild before they can even start to fulfill orders

In this case, what is your BCRP?

9. Contractual Bondage

Get those pencils sharpened and those contracts amended. Have an addendum added to have your vendor/supplier responsible for their own BCRP plan. Why?

If you are at this stage, you are not the only one looking for operational efficiency. Your vendor will be outsourcing their tasks. Your risks will now be N+1+1.

10. Build the Chain

To end with, the last chorus of Robert Burns song:

And there’s a hand my trusty friend!
And give us a hand o’ thine!
And we’ll take a right good-will draught,
for auld Lang syne

You have now forged the link. Repeat steps 1-9 annually.

It s time to build the chain. Best of luck!!

Andrew Fernandes is a certified business continuity practitioner with more than 10 years of hands-on experience in business continuity and process improvements. He is employed with Dell Inc., USA since 2005 as global manager in the BCRP PMO office.

Drj.com has thousands of articles that will help you learn more about a disaster recovery plan. We have been in the disaster recovery industry for many years and we have partnered with the world's top experts when it comes to business continuity and gathering reliable information on disaster recovery plan templates.